How to create time series with make-series in KQL

The make-series operator in KQL turns rows of events into a continuous time series, with one point for every time interval — even for the periods when there was no data. It is what you need to draw reliable trend charts and to apply the KQL series-analysis functions. This is how to create time series with make-series step by step, from sample data to a line chart, in Real-Time Analytics in Microsoft Fabric or in Azure Data Explorer.

Prerequisites

• Access to a KQL Queryset in Microsoft Fabric or to an Azure Data Explorer cluster.
• Basic KQL knowledge: knowing summarize and where helps, but is not required.
• A table with a date/time column (datetime). In this example we create the data with datatable, so you can follow along without any table.

Step 1: Understand the difference from summarize

With summarize ... by bin() you get one row for every interval that has data. Days without events simply do not show up, which leaves "holes" in the chart. make-series fixes this: it builds a regular time axis from start to end and fills the empty intervals with a value of your choice (for example, 0). The result is a single row that holds arrays with every point of the series. Without this regular grid, a break in the chart can look like a real drop when it was only missing data — and that leads to wrong readings and wrong decisions.

Step 2: Prepare sample data

We will use a small sales set. Notice there are no records on July 2 and 5 — that is exactly where make-series shines.

let Vendas = datatable(Timestamp:datetime, Produto:string, Valor:real)
[
    datetime(2026-07-01 09:15), "A", 120,
    datetime(2026-07-01 11:40), "B", 80,
    datetime(2026-07-03 14:05), "A", 200,
    datetime(2026-07-04 10:00), "B", 150,
    datetime(2026-07-06 16:30), "A", 90
];
Vendas
| make-series TotalDiario = sum(Valor) on Timestamp step 1d

Without a range, make-series uses the minimum and maximum dates in the data. You already get a series, but it is better to control the start and end.

Step 3: Set start, end and step

Use from, to and step to pin the time grid, and default=0 to fill the days with no sales with zero:

Vendas
| make-series TotalDiario = sum(Valor) default=0
    on Timestamp
    from datetime(2026-07-01) to datetime(2026-07-07) step 1d

The series now always has 6 points (July 1 to 6), with 0 on the 2nd and 5th. The grid is regular, which is essential to compare periods and to use the series functions.

The step accepts any time interval: use 1h to group by hour, 15m every fifteen minutes, or 7d by week. Pick the granularity your analysis needs.

Step 4: One series per category

To compare products, add by. Each product gets its own series, aligned on the same time axis:

Vendas
| make-series TotalDiario = sum(Valor) default=0
    on Timestamp
    from datetime(2026-07-01) to datetime(2026-07-07) step 1d
    by Produto

The result has one row per product, each with its own TotalDiario array.

Step 5: Chart the trend

make-series plugs straight into render timechart, which draws a line chart with time on the horizontal axis:

Vendas
| make-series TotalDiario = sum(Valor) default=0
    on Timestamp
    from datetime(2026-07-01) to datetime(2026-07-07) step 1d
    by Produto
| render timechart

Check the result

Confirm it is correct in three ways: (1) the TotalDiario column shows up as an array (type dynamic); (2) each array has exactly 6 values, including the zeros for July 2 and 5; (3) on the chart, the line is continuous and drops to zero on those days instead of "jumping" over them. If you want one row per day again, use mv-expand to expand the arrays.

Conclusion

With make-series you moved from scattered events to a regular time series that is ready to analyze. The natural next step is to explore the KQL series functions, such as series_fir for moving averages or series_decompose_anomalies to detect anomalies automatically. Which one will you try first in your next Real-Time Analytics dashboard?